[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

[Assistant]
According to Recommendation for Key Management_ Part 1 – General:

| 1 | | 1.1 | Purpose ..............................................................................................................................1 | Purpose ..............................................................................................................................1 | | | 1.2 | Audience............................................................................................................................1 | Audience............................................................................................................................1 | | | 1.3 | Scope .................................................................................................................................2 | Scope .................................................................................................................................2 | | | 1.4 | Purpose of FIPS and NIST Recommendations (NIST Standards) ....................................3 | Purpose of FIPS and NIST Recommendations (NIST Standards) ....................................3 | | | 1.5 | Content and Organization..................................................................................................4 | Content and Organization..................................................................................................4 | | | 2 Glossary of Terms and Acronyms...........................................................................

Recommendation for Key Management_ Part 1 – General


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Configuration Management?

[Assistant]
According to Guidelines for Securing Wireless Local Area Networks (WLANs):

1 | | | 1.1 | Authority....................................................................................................................1 | | | 1.2 | Purpose and Scope...................................................................................................1 | | | 1.3 | ...................................................................................................................1 | | | 1.4 | Audience Document Structure ..................................................................................................1 | | 2.

Guidelines for Securing Wireless Local Area Networks (WLANs)


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Configuration Management?

[Assistant]
According to Recommendation for Cryptographic Key Generation:

11. New Section 6.3 (old Section 6.6) on combining multiple keys:
- a. The notation for the other data items has been changed from Vi to Di to avoid a conflict with the use of Vi in Section 3.4.
- b. Additional discussion on combining key components has been added.
- c. Methods 2 and 3 from the previous version have been combined into the new Method 2.
- d. A new method using HMAC has been added as (a new) Method 3.
- e. Guidance for using each method has been further clarified.
12. New Section 6.4: Moved from the old Section 6.2.
13. References are now an independent section instead of an Appendix.

Recommendation for Cryptographic Key Generation


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Planning?

[Assistant]
According to Report of the Virtual Workshop on Usable Cybersecurity and Privacy for Immersive Technologies:

There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may be used by federal agencies even before the completion of such companion publications. Thus, until each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST.

Report of the Virtual Workshop on Usable Cybersecurity and Privacy for Immersive Technologies


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AC.L2-3.1.1 (NIST 3.1.1)?

[Assistant]
According to Interfaces for Personal Identity Verification_ Part 2 – PIV Card Application Card Command Interface:

3.1.1. 3.1.1.

Interfaces for Personal Identity Verification_ Part 2 – PIV Card Application Card Command Interface


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Information Integrity?

[Assistant]
According to Recommended Criteria for Cybersecurity Labeling for Consumer Internet of Things (IoT) Products:

interfaces to the IoT product will help preserve the confidentiality, integrity, and availability of the IoT product, its components, and data by helping prevent unauthorized access and modification.
| Vulnerability Factors                                                                                | Example Relevant Tactics: Techniques from ATT&CK                                                                                | Related Baseline Criteria                                                                                |
|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| devices vulnerable to unauthorized access through internet and other network connections.

Recommended Criteria for Cybersecurity Labeling for Consumer Internet of Things (IoT) Products


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Configuration Management?

[Assistant]
According to Recommendation for Pair-Wise Key-Establishment Using Integer Factorization Cryptography:

To include bilateral key confirmation, two instances of unilateral key confirmation (as specified in Section 5.6.1, subject to the modifications listed below) shall be incorporated into the KAS2 scheme, once with party U as the key-confirmation provider (i.e., P = U and R = V) and once with party  V  as  the  key-confirmation  provider  (i.e.,  P  =  V  and  R  =  U).  Additional  details  will  be provided in Section 8.3.3.4.

Recommendation for Pair-Wise Key-Establishment Using Integer Factorization Cryptography


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] How does The Technical Specification for the Security Content Automation Protocol (SCAP)_ SCAP Version 1.1 support CMMC certification?

[Assistant]
According to The Technical Specification for the Security Content Automation Protocol (SCAP)_ SCAP Version 1.1:

r security and its collaborative activities with industry, government, and academic organizations. National Institute of Standards and Technology Special Publication 800-126, Revision 1 39 pages (Feb.
2011)

Certain commercial entities, equipment, or materials may be identified in this document in order to describe an experimental procedure or concept adequately. Such identification is not intended to imply recommendation or endorsement by the National Institute of Standards and Technology, nor is it intended to imply that the entities, materials, or equipment are necessarily the best available for the purpose. ## Acknowledgments

The authors, David Waltermire and Stephen Quinn of the National Institute of Standards and Technology (NIST), and Karen Scarfone of G2, Inc., wish to thank their colleagues who reviewed drafts of this document and contributed to its technical content. The authors would like to acknowledge John Banghart, Harold Booth, Paul Cichonski, and Blair Heiserman of NIST; Christopher Johnson of HP Enterprise Services; Paul Bartock of the National Security Agency (NSA); Jeff Ito, Matt Kerr, Shane Shaffer, and Greg Witte of G2, Inc.; Andy Bove of SecureAcuity; Jim Ronayne of Varen Technologies; Adam Halbardier, Rhonda Farrell, Angela Orebaugh, and Victoria Thompson of Booz Allen Hamilton; Alan Peltzman of the Defense Information Systems Agency (DISA); and Jon Baker, Drew Buttner, Maria Casipe, and Charles Schmidt of the MITRE Corporation for their keen and insightful assistance throughout the development of the document. ## Trademark Information

OVAL and CVE are registered trademarks, and CCE, CPE, and OCIL are trademarks, of The MITRE Corporation. XCCDF and SCAP are trademarks of NIST. Windows XP, Windows Vista, and Windows Server 2003 are registered trademarks of Microsoft Corporation. All other registered trademarks or trademarks belong to their respective organizations.

The Technical Specification for the Security Content Automation Protocol (SCAP)_ SCAP Version 1.1

Planning
System and Services Acquisition
Physical Protection
Awareness and Training
Incident Response
Supply Chain Risk Management
Configuration Management
Maintenance
Security Assessment
System and Communications Protection
Media Protection
Risk Assessment
Audit and Accountability
Personnel Security
Identification and Authentication
Access Control
System and Information Integrity


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Communications Protection?

[Assistant]
According to Considerations for Managing Internet of Things (IoT) Cybersecurity and Privacy Risks:

he software implementation of the networking protocol that uses the card or chip). Examples of network interface capabilities include Ethernet, Wi-Fi, Bluetooth, Long-Term Evolution (LTE), and ZigBee.
Every IoT device has at least one enabled network interface capability and may have more than one. - Supporting capabilities provide functionality that supports the other IoT capabilities. Examples are device management, cybersecurity, and privacy capabilities. [2]

Considerations for Managing Internet of Things (IoT) Cybersecurity and Privacy Risks


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Audit and Accountability?

[Assistant]
According to Guide to Protecting the Confidentiality of Personally Identifiable Information (PII):

The authors, Erika McCallister, Tim Grance, and Karen Scarfone of the National Institute of Standards and Technology (NIST), wish to thank their colleagues who reviewed drafts of this document and contributed to its technical content. Of particular note are the efforts of Joseph Nusbaum of Innovative Analytics & Training, Deanna DiCarlantonio of CUNA Mutual Group, and Michael L. Shapiro and Daniel I. Steinberg of Booz Allen Hamilton, who contributed significant portions to previous versions of the document. The authors would also like to acknowledge Ron Ross, Kelley Dempsey, and Arnold Johnson of NIST; Michael Gerdes, Beth Mallory, and Victoria Thompson of Booz Allen Hamilton; Brendan Van Alsenoy of ICRI, K.U.Leuven; David Plocher and John de Ferrari of the Government Accountability Office; Toby Levin of the Department of Homeland Security; Idris Adjerid of Carnegie Mellon University; The Federal Committee on Statistical Methodology: Confidentiality and Data Access Committee; The Privacy Best Practices Subcommittee of the Chief Information Officers Council; and Julie McEwen and Aaron Powell of The MITRE Corporation, for their keen and insightful assistance during the development of the document.

Guide to Protecting the Confidentiality of Personally Identifiable Information (PII)


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Risk Assessment?

[Assistant]
According to Case Studies in Cyber Supply Chain Risk Management_ Palo Alto Networks, Inc.:

s challenging for organizations at every maturity level. Palo Alto Networks leverages established contract manufacturers with demonstrably diligent cybersecurity and supplier risk management programs.
Given Palo Alto Networks' role as a cybersecurity vendor, the company is subject to intense scrutiny from potential customers and is a target for a variety of threat actors. Recognizing that a product security incident could have an enormous impact on customers, Palo Alto Networks considers cybersecurity and product integrity an implicit corporate mandate. All products are subject to the company's end-to-end product security framework (E2E Framework). The framework is designed to provide defense in depth for each stage of the product lifecycledesign, sourcing, manufacturing, fulfilment, and service. Each stage is independently evaluated to determine security risks, and domain experts select relevant public standards and best practices to target those risks. Selected standards include the Federal Information Processing Standards (FIPS) i , Common Criteria ii , and the United Kingdom's Commercial Product Assurance (CPA) iii .

Case Studies in Cyber Supply Chain Risk Management_ Palo Alto Networks, Inc.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Ordered t-way Combinations for Testing State-based Systems provide? (Part 2)

[Assistant]
lication of the results to verify and test state-based systems. ## Keywords

combinatorial coverage; combinatorial methods; combinatorial testing; software testing; structural coverage; test coverage.
## Disclaimer

Any mention of commercial products or reference to commercial organizations is for information only; it does not imply recommendation or endorsement by NIST, nor does it imply that the products mentioned are necessarily the best available for the purpose. ## Additional Information

For additional information on NIST's Cybersecurity programs, projects and publications, visit the Computer Security Resource Center. Information on other efforts at NIST and in the Information Technology Laboratory (ITL) is also available. cfdwp@nist.gov

Submit comments on this publication to:

National Institute of Standards and Technology Attn: Computer Security Division, Information Technology Laboratory 100 Bureau Drive (Mail Stop 8930) Gaithersburg, MD 20899-8930

## 1 Introduction

Vulnerability and fault detection often depend on the specific  order  of  inputs  that  establish  states  which eventually lead to a failure. That is, many software processes  are  not  deterministic  functions  where  an input produces the same output whenever the process is invoked irrespective of previous invocations. This is  particularly  true  of  real-time  systems,  which  are designed  to  run  continuously,  maintain  states,  and respond to a changing series of inputs. Such systems are typically driven by a loop function that accepts input values, processes and responds to those inputs, and  updates  its  current  state. Examples  include network protocols and data servers. The system state may change, depending on input, and the system may subsequently respond differently to the same input. That is, the response of the process to a particular set of input values may depend on its current state, such as whether a communication protocol is in a listen or connection-open state.

Ordered t-way Combinations for Testing State-based Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Information Integrity?

[Assistant]
According to Cell Phone Forensic Tools_ an Overview and Analysis Update:

ther Paraben's Toolbox or a compatible cable (e.g., datapilot) to establish a data-link between the phone and the forensic workstation. The type of phone being acquired determines the cable interface.
Serial RS-232 and USB data-link connections are established via the phone data port or the under-battery interface connection. Device Seizure uses the MD5 hash function to protect the integrity of acquired files. Additional features include bookmarking of information to be filtered and organized in a report format, searching for text strings within the acquired data, and automatically assembling found images under a single facility.

Cell Phone Forensic Tools_ an Overview and Analysis Update


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Physical Protection?

[Assistant]
According to Recommendation for Key Derivation Using Pseudorandom Functions:

The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology. ITL's responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems. The Special Publication 800-series reports on ITL's research, guidelines, and outreach efforts in information system security, and its collaborative activities with industry, government, and academic organizations.

Recommendation for Key Derivation Using Pseudorandom Functions


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Communications Protection?

[Assistant]
According to Codes for Identification of Federal and Federally-Assisted Organizations:

| | 12B7 | USDA, Office of the Judicial Officer | | 12B8 | USDA, Board of Contract Appeals ` | | 12BD | USDA, Office of Ethics | | 1215 | USDA, Office of Operations | | 12B0 | USDA, Assistant Secretary for Administration | | 12C0 | Under Secretary for Natural Resources and Environment | | 12C2 | Forest Service | | 12C3 | Natural Resources Conservation Service | | 12D0 | Under Secretary for Farm and Foreign Agricultural Services | | 12D2 | Farm Service Agency | | 12D3 | Foreign Agricultural Service | | 12D4 | Risk Management Agency | | 1263 | Federal Crop Insurance Corporation | | 1260 | Commodity Credit Corporation | | 12E0 | Under Secretary for Rural Development |

Codes for Identification of Federal and Federally-Assisted Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Module-Lattice-Based Key-Encapsulation Mechanism Standard provide? (Part 2)

[Assistant]
the Module Learning with Errors problem. At present, ML-KEM is believed to be secure, even against adversaries who possess a quantum computer. This standard specifies three parameter sets for ML-KEM.
In order of increasing security strength and decreasing performance, these are ML-KEM-512, ML-KEM-768, and ML-KEM-1024. Keywords: computer security; cryptography; encryption; Federal Information Processing Standards; key-encapsulation mechanism; lattice-based cryptography; post-quantum; public-key cryptography. ## Federal Information Processing Standards Publication 203

Published:

August 13, 2024

Effective:

August 13, 2024

## Announcing the

## Module-Lattice-Based Key-Encapsulation Mechanism Standard

Federal Information Processing Standards (FIPS) publications are developed by the National Institute of Standards and Technology (NIST) under 15 U.S.C. 278g-3 and issued by the Secretary of Commerce under 40 U.S.C. 11331. 1. Name of Standard. Module-Lattice-Based Key-Encapsulation Mechanism Standard (FIPS 203). 2. Category of Standard. Computer Security. Subcategory. Cryptography. 3. Explanation. A cryptographic key (or simply 'key') is represented in a computer as a string of bits. A shared secret key is a cryptographic key that is computed jointly by two parties (e.g., Alice and Bob) using a set of algorithms. Under certain conditions, these algorithms ensure that both parties will produce the same key and that this key is secret from adversaries. Such a shared secret key can then be used with symmetric-key cryptographic algorithms (specified in other NIST standards) to perform tasks such as encryption and authentication of digital information. This standard specifies a set of algorithms for establishing a shared secret key. While there are many methods for establishing a shared secret key, the particular method described in this standard is a key-encapsulation mechanism (KEM).

Module-Lattice-Based Key-Encapsulation Mechanism Standard


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Guidelines for Smart Grid Cybersecurity provide? (Part 3)

[Assistant]
framework that organizations can use to develop effective cybersecurity strategies tailored to their
particular  combinations  of  smart  grid-related  characteristics,  risks,  and  vulnerabilities.
Organizations in the diverse community of smart grid stakeholders—from utilities to providers of
energy management services to manufacturers of electric vehicles and charging stations—can
use the methods and supporting information presented in this report as guidance for assessing
risk  and  identifying  and  applying  appropriate  security  requirements. This  approach  recognizes
that  the  electric  grid  is  changing  from  a  relatively  closed  system  to  a  complex,  highly
interconnected  environment. Each  organization’s  cybersecurity  requirements  should  evolve  as
technology advances and as threats to grid security inevitably multiply and diversify. advanced metering infrastructure; architecture; cryptography; cybersecurity; electric grid;
privacy; security requirements; smart grid

Keywords

ACKNOWLEDGMENTS

This revision to the NISTIR was developed by members of the Smart Grid Interoperability Panel
(SGIP) Smart Grid Cybersecurity Committee (SGCC) (formerly the Cyber Security Working
Group (CSWG)), which is chaired by Victoria Yan Pillitteri (NIST). Dave Dalva (Stroz
Friedberg), Akhlesh Kaushiva (Department of Energy), and Scott Saunders (Sacramento
Municipal Utility District) are the vice chairs and Mark Enstrom (Neustar) and Amanda Stallings
(Ohio PUC) have served as the secretary. Tanya Brewer of NIST is the lead editor of this report. A special note of thanks goes to the subgroup leads, Frances Cleveland (Xanthus Consulting
International), Nelson Hastings (NIST), Rebecca Herold (Rebecca Herold & Associates, LLC),
Elizabeth Sisley (Calm Sunrise Consulting, LLC), and Doug McGinnis (Exelon) who along with
their subgroup team members contributed significantly to this revision.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to A Profile for U.S. Federal Cryptographic Key Management Systems (CKMS):

access control; confidentiality; cryptographic key management system; disaster recovery; federal cryptographic key management system; integrity; metadata; security assessment; security functions; security policies; source authentication.

A Profile for U.S. Federal Cryptographic Key Management Systems (CKMS)


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to NIST Privacy Framework_ A Tool for Improving Privacy Through Enterprise Risk Management, Version 1.0:

2 A complete development archive can be found at https://www.nist.gov/privacy-framework. | Executive Summary............................................................................................................................... i             | Executive Summary............................................................................................................................... i             | Executive Summary...............................................................................................................................

NIST Privacy Framework_ A Tool for Improving Privacy Through Enterprise Risk Management, Version 1.0


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Audit and Accountability?

[Assistant]
According to Practical Combinatorial Testing:

## 3.3.1 Invalid Combinations and Constraints

## 3.3.2 Cost Factors

- the subject is an employee AND current time is between 9 am and 5 pm AND it is not a weekend
- OR subject is an employee with a special authorization code
- OR subject is an auditor AND the time is between 9 am and 5 pm (not constrained to weekdays).


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Maintenance?

[Assistant]
According to Key Practices in Cyber Supply Chain Risk Management_ Observations from Industry:

- -NISTIR 7622, Notional Supply Chain Risk Management Practices for Federal Information Systems , 2012 [NISTIR 7622] - -NIST Special Publication (SP) 800-161, Supply Chain Risk Management Practices for Federal Information Systems and Organizations , 2015 [SP 800-161] - -NIST SP 800-37 Revision 2, Risk Management Framework for Information Systems and Organizations, 2018 [SP800-37] - -NIST SP 800-53, Revision 5, Security and Privacy Controls for Information Systems and Organizations , 2020 [SP 800-53] - -Relevant controls and control enhancements include: -  Supply Chain Risk Management Control Family (SR) -  Supply Chain Risk Management Strategy (PM-30) -  Suppliers of Critical or Mission Essential Items (PM-30(1)) -  Integrated Situational Awareness (SI-4(17)) -  External System Services (SA-9) -  Acquisition Process (SA-4) -  Supply Chain Risk Assessment (RA-3(1)) -  Criticality Analysis (RA-9) -  Incident Handling - Supply Chain Coordination (IR-4(10)) -  Incident Reporting - Supply Chain Coordination (IR-6(3)) -  Controlled Maintenance (MA-2) -  Tamper Protection (PE-3(5)) - -Case studies, briefing papers, and other resources on the NIST Cyber Supply Chain Risk Management site [NIST C-SCRM]: 7 - -Case Studies: Best Practices in Cyber Supply Chain Risk Management, 2015 - -Best Practices in

Key Practices in Cyber Supply Chain Risk Management_ Observations from Industry


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Physical Protection?

[Assistant]
According to Glossary of Key Information Security Terms:

The  Information  Technology  Laboratory  (ITL)  at  the  National  Institute  of  Standards  and Technology  (NIST)  promotes  the  U.S.  economy  and  public  welfare  by  providing  technical leadership  for  the  Nation's  measurement  and  standards  infrastructure.  ITL  develops  tests,  test methods, reference data, proof of concept implementations, and technical analyses to advance the development  and  productive  use  of  information  technology.  ITL's  responsibilities  include  the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems.

Glossary of Key Information Security Terms


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Configuration Management?

[Assistant]
According to Stateless Hash-Based Digital Signature Standard:

```
1: if |𝑐𝑡𝑥| > 255 then 2: return ⊥ ▷ return an error indication if the context string is too long 3: end if $ 4: 𝑎𝑑𝑑𝑟𝑛𝑑 ← -𝔹 𝑛 ▷ skip lines 4 through 7 for the deterministic variant 5: if 𝑎𝑑𝑑𝑟𝑛𝑑 = NULL then 6: return ⊥ ▷ return an error indication if random bit generation failed 7: end if 8: switch PH do 9: case SHA-256: 10: OID ← toByte (0 x0609608648016503040201 , 11) ▷ 2.16.840.1.101.3.4.2.1 11: PH 𝑀 ← SHA-256 (𝑀) 12: case SHA-512: 13: OID ← toByte (0 x0609608648016503040203 , 11) ▷ 2.16.840.1.101.3.4.2.3 14: PH 𝑀 ← SHA-512 (𝑀) 15: case SHAKE128: 16: OID ← toByte (0 x060960864801650304020B , 11) ▷ 2.16.840.1.101.3.4.2.11 17: PH 𝑀 ← SHAKE128 (𝑀, 256) 18: case SHAKE256: 19: OID ← toByte (0 x060960864801650304020C , 11) ▷ 2.16.840.1.101.3.4.2.12 20: PH 𝑀 ← SHAKE256 (𝑀, 512) 21: case … ▷ other approved hash functions or XOFs 22: … 23: end switch 24: 𝑀 ′ ← toByte (1, 1) ∥ toByte (|𝑐𝑡𝑥|, 1) ∥ 𝑐𝑡𝑥 ∥ OID ∥ PH 𝑀 25: SIG ← slh _ sign _ internal (𝑀 ′ , SK , 𝑎𝑑𝑑𝑟𝑛𝑑) ▷ omit 𝑎𝑑𝑑𝑟𝑛𝑑 for the deterministic variant 26: return SIG
```

```
1: if |𝑐𝑡𝑥| > 255 then 2: return false 3: end if 4: switch PH do 5: case SHA-256: 6: OID ← toByte (0 x0609608648016503040201 , 11) ▷ 2.16.840.1.101.3.4.2.1 7: PH 𝑀 ← SHA-256 (𝑀) 8: case SHA-512: 9: OID ← toByte (0 x0609608648016503040203 , 11) ▷ 2.16.840.1.101.3.4.2.3 10: PH 𝑀 ← SHA-512 (𝑀) 11: case SHAKE128: 12: OID ← toByte (0 x060960864801650304020B , 11) ▷ 2.16.840.1.101.3.4.2.11 13: PH 𝑀 ← SHAKE128 (𝑀, 256) 14: case SHAKE256: 15: OID ← toByte (0 x060960864801650304020C , 11) ▷ 2.16.840.1.101.3.4.2.12 16: PH 𝑀 ← SHAKE256 (𝑀, 512) 17: case … ▷ other approved hash functions or XOFs 18: … 19: end switch 20: 𝑀 ′ ← toByte (1, 1) ∥ toByte (|𝑐𝑡𝑥|, 1) ∥ 𝑐𝑡𝑥 ∥ OID ∥ PH 𝑀 21: return slh _ verify _ internal (𝑀 ′ , SIG , PK )
```

Stateless Hash-Based Digital Signature Standard


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Security Assessment?

[Assistant]
According to Guide to Computer Security Log Management:

| 5.3                                                                                | Respond to Identified Events................................................................................. | 5-8                |
|-----------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------|--------------------|
| 5.4                                                                                | Manage Long-Term Log Data Storage .................................................................. | 5-9                |
| 5.5                                                                                | Provide Other Operational Support...................................................................... | 5-10               |
| 5.6                                                                                | Perform Testing and Validation ........................................................................... | 5-10               |
| 5.7                                                                                | Summary.............................................................................................................

Guide to Computer Security Log Management


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Incident Response?

[Assistant]
According to Hardware-Enabled Security_ Enabling a Layered Approach to Platform Security for Cloud and Edge Computing Use Cases:

For example, LoJax, discovered in August 2018, manifests itself in UEFI malware, allowing it to continuously persist in the firmware layer despite operating system (OS) reinstallations, and thus remain invisible to standard kernel-based virus scans [1]. These attacks can be devastating to cloud environments because they often require server-by-server rebuilds or replacements, which can take weeks. Although still rare, these attacks are increasing as attackers become more sophisticated.

VM isolation can be used to help protect workloads in multi-tenant environments like public and hybrid clouds. Isolating entire VMs translates to protection against malicious insiders at the cloud provider, or malware exposure and data leakage to other tenants with workloads running on the same platform. Many modern cloud deployments use VMs as container worker nodes. This provides a highly consistent and scalable way to deploy containers regardless of the underlying physical platforms. With full VM isolation, the virtual workers hosting container

'UEFI Secure Boot (SB) is a verification mechanism for ensuring that code launched by a computer's UEFI firmware is trusted' [19]. SB prevents malware from taking 'advantage of several pre-boot attack points, including the system-embedded firmware itself, as well as the interval between the firmware initiation and the loading of the operating system' [20].

Hardware-Enabled Security_ Enabling a Layered Approach to Platform Security for Cloud and Edge Computing Use Cases


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to Prioritizing Cybersecurity Risk for Enterprise Risk Management:

| Executive Summary............................................................................................................................1             |
|------------------------------------------------------------------------------------------------------------------------------------------------------------|
| 1. Introduction...................................................................................................................................4        |
| 2. Cybersecurity Risk Considerations ..................................................................................................9                   |
| 2.2.1. Factors Influencing Prioritization ................................................................................................12               |
| 2.2.2. Cybersecurity Risk Optimization .................................................................................................12                 |
| 2.2.3. Cybersecurity Risk Priorities at Each Enterprise Level................................................................14                            |
| 2.2.4. Considerations of Positive Risks as an Input to ERM..................................................................15                             |
| 2.2.5. Visualizing Risk Priority ...............................................................................................................16         |
| 2.3.1. Risk Acceptance...........................................................................................................................21        |
| 2.3.2. Risk Avoidance ............................................................................................................................22       |
| 2.3.3. Risk Transfer................................................................................................................................22     |
| 2.3.4.

Prioritizing Cybersecurity Risk for Enterprise Risk Management


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Communications Protection?

[Assistant]
According to Satellite Ground Segment_ Applying the Cybersecurity Framework to Satellite Command and Control:

| Subcategory | Applicability to the Ground Segment | References | |----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | ID.BE-4 : Dependencies and critical functions for delivery of critical services are established | Organizations should identify any critical capabilities from other sectors such as power, transportation, communications, timing etc.

Satellite Ground Segment_ Applying the Cybersecurity Framework to Satellite Command and Control


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Risk Assessment?

[Assistant]
According to Verification and Test Methods for Access Control Policies_Models:

III | |---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------| | 1 INTRODUCTION ...................................................................................................1 | 1 INTRODUCTION ...................................................................................................1 | 1 INTRODUCTION ...................................................................................................1 | | 1.1 Authority..........................................................................................................................1 1.2 Document Scope and Purpose | 1.1 Authority..........................................................................................................................1 1.2 Document Scope and Purpose | .........................................................................................1 | | 1.3 Audience and Assumptions..............................................................................................2 | 1.3 Audience and Assumptions..............................................................................................2 | | | 1.4 Document Organization...................................................................................................2 | 1.4 Document Organization...................................................................................................2 | | | 2 ACCESS CONTROL POLICIES AND MODELS .......................................................3 | 2 ACCESS CONTROL POLICIES AND MODELS .......................................................3 | 2 ACCESS CONTROL POLICIES AND MODELS .......................................................3 | | 2.1 Access Control Policies ...................................................................................................3 | 2.1 Access Control Policies ...................................................................................................3 | | | 2.2 AC Models.......................................................................................................................5 | 2.2 AC Models.......................................................................................................................5 | | | 3 ACCESS CONTROL SAFETY AND FAULTS ...........................................................8 | 3 ACCESS CONTROL SAFETY AND FAULTS ...........................................................8 | 3 ACCESS CONTROL SAFETY AND FAULTS ...........................................................8 | | 3.1 Safety | 3.1 Safety | | | ...............................................................................................................................8 3.2 AC Faults .........................................................................................................................8 | ...............................................................................................................................8 3.2 AC Faults .........................................................................................................................8 | | | 3.3 Multi-policies considerations...........................................................................................9 | 3.3 Multi-policies considerations...........................................................................................9 | | | 3.4 Vulnerability Hierarchies in Access Control Configurations ........................................10 | 3.4 Vulnerability Hierarchies in Access Control Configurations ........................................10 | | | 4 POLICY VERIFICATION PRINCIPLES.................................................................15 | 4 POLICY VERIFICATION PRINCIPLES.................................................................15 | | | 4.1 Model Verification.........................................................................................................15 |

Verification and Test Methods for Access Control Policies_Models


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to Implementation of DevSecOps for a Microservices-based Application with Service Mesh:

There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may  be  used  by  federal  agencies  even  before  the  completion  of  such  companion  publications. Thus,  until  each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning  and  transition  purposes,  federal  agencies  may  wish  to  closely  follow  the  development  of  these  new publications by NIST. The  Information  Technology  Laboratory  (ITL)  at  the  National  Institute  of  Standards  and Technology  (NIST)  promotes  the  U.S. economy  and  public  welfare  by  providing  technical leadership  for  the  Nation's  measurement  and  standards  infrastructure. ITL  develops  tests,  test methods, reference data, proof of concept implementations, and technical analyses to advance the development  and  productive  use  of  information  technology. ITL's  responsibilities  include  the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems. Cloud-native applications have evolved into a standardized architecture consisting of multiple loosely coupled components called microservices (often typically implemented as containers) that are supported by an infrastructure for providing application services, such as service mesh. Both of these components are usually hosted on a container orchestration and resource management platform.

Implementation of DevSecOps for a Microservices-based Application with Service Mesh


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Security Assessment?

[Assistant]
According to Cybersecurity for Smart Inverters_ Guidelines for Residential and Light Commercial Solar Energy Systems:

|
| Table 1.
Technical cybersecurity capability recommendations...........................................................14                                                                                |
| Table 2. Non-technical cybersecurity capability recommendations....................................................19                                                                                |
| Table 3. Characteristics of tested inverters .......................................................................................28                                                                                |
| Table 4. Guideline #1 testing results .................................................................................................28                                                                                |
| Table 5. Guideline #2 testing results .................................................................................................29                                                                                |
| Table 6. Guideline #3 testing results .................................................................................................29                                                                                |
| Table 7. Guideline #4 testing results .................................................................................................30                                                                                |
| Table 8.

Cybersecurity for Smart Inverters_ Guidelines for Residential and Light Commercial Solar Energy Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Communications Protection?

[Assistant]
According to Assessing Federal and Commercial Information Security Needs:

The U.S. government has been involved in developing security technology for computer and communications security for some time.

The NIST study team met with 28 organizations -17 federal agencies, 10 commercial organizations, and 1 state government. Fourteen of the organizations were in the Washington/Baltimore area and 14 were outside of this area, and included Arizona, California, New Jersey, New York, Pennsylvania, and Texas. Companies representing energy, financial, communications, insurance, manufacturing, computers, and service were included. Of the federal organizations, both the executive and judicial branches were represented. Activities included law enforcement, benefits delivery, nuclear/energy, space exploration, defense, tax system, information collection and dissemination, air traffic, and service center operations. Contractors participated in a number of the federal agency meetings. State functions represented included justice, transportation, lottery, franchise tax, health and welfare, motor vehicles, controllers office, and data center operations.

The study team found that most commercial organizations take a carefully measured and cost-effective approach to computer and communications security issues. Each commercial organization interviewed described computer security as an important and necessary capability of their computer systems. However, such statements were quickly caveated with the reality that a business case is also presented regarding the merits of such capabilities. This business case was described as balancing the:

Assessing Federal and Commercial Information Security Needs


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Audit and Accountability?

[Assistant]
According to Guide to IPsec VPNs:

1. Identify Needs - Identify the need to protect network communications and determine how that need can best be met. 2. Design the Solution - Make design decisions in several areas, including architectural considerations, authentication methods, cryptographic policy, and packet filters. The placement of an IPsec gateway has potential security, functionality, and performance implications. An authentication solution should be selected based primarily on maintenance, scalability, and security. Packet filters should apply appropriate protections to traffic and not protect other types of traffic for performance or functionality reasons. 3. Implement and Test a Prototype - Test a prototype of the designed solution in a lab or test environment to identify any potential issues. Testing should evaluate several factors, including connectivity, protection, authentication, application compatibility, management, logging, performance, the security of the implementation, and component interoperability. 4. Deploy the Solution - Gradually deploy IPsec throughout the enterprise.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Physical Protection?

[Assistant]
According to Understanding Stablecoin Technology and Related Security Considerations:

ir pegged asset, currency, or index. This is in great contrast to most cryptocurrencies (e.g., Bitcoin) whose value experiences significant volatility and whose price is dictated by supply and demand.
Unlike other cryptocurrencies, there is no expectation of earnings through holding stablecoins (unless the pegged asset is expected to rise in value over time). However, even stablecoins with no expectation of earnings can themselves be invested in decentralized finance products that do promise to yield returns.

Understanding Stablecoin Technology and Related Security Considerations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Security Assessment?

[Assistant]
According to Guide to a Secure Enterprise Network Landscape:

r example, the risk profile of the device can be obtained through an out-of-the-box posture check (risk of the device [28]) with or without integrating with an endpoint protection tool for the device.
Other crucial information (provided by telemetry data) needed to assess the security status of the endpoint devices [29] include (a) device support label (the device is managed or corporate-owned) and (b) device posture information (whether it has been compromised). All of these factors go into a policy evaluation for determining the level of trust and must be channeled into authentication and monitoring decisions [30]. 3. Information about real-time contextual data - Date, time, and geolocation at which the access request occurs
4. Information about IT services (e.g., app, data) being accessed
5. Information about the security of the environment hosting the IT services being accessed

Guide to a Secure Enterprise Network Landscape


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Maintenance?

[Assistant]
According to Summary Report for the Virtual Workshop Addressing Public Comment on NIST Cybersecurity for IoT Guidance:

capabilities required from IoT devices and their manufacturers, respectively, as well as associated documentation to round out the guidance provided by the program. The documents are complemented by an online catalog [CATALOG] of detailed technical capabilities and supporting non-technical capabilities, updates that were published in March of 2021.

- Smart Door Lock:  Federal organizations may utilize connected door locks that can scan PIV cards and manage access to and within facilities.
- Unmanned Aircraft System (UAS):  Federal organizations could use UAS to inspect facilities as part of monitoring and maintenance of the facility.
- Water Sensors: Some federal organizations may use connected IoT environment sensors to monitor various aspects of facilities.

Mr. Fagan concluded by briefly reviewing updates to the online IoT device cybersecurity capabilities catalog and encouraging workshop participants to provide input and feedback on the catalog's contents and utility.

Summary Report for the Virtual Workshop Addressing Public Comment on NIST Cybersecurity for IoT Guidance


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Supply Chain Risk Management?

[Assistant]
According to Guide to Cyber Threat Information Sharing:

- Experienced cybersecurity personnel,
- Members and operators of established threat information sharing organizations,
- Trusted business associates, supply chain partners, and industry peers, and
- Personnel knowledgeable about legal issues, internal business processes, procedures, and systems.

may be based on geographic region, political boundary, industrial sector, business interest, or threat space (e.g., focused on phishing attacks). Many of these communities have multinational constituencies and global reach. Examples of potential sharing partners are ISACs, domestic and foreign Computer Emergency Readiness Teams (CERTs) or CSIRTs, Information Sharing and Analysis Organizations (ISAOs), DHS Automated Indicator Sharing (AIS) initiative, threat and vulnerability repositories, law enforcement agencies, product vendors, managed security service providers, internet service providers, supply chain partners, industry sector peers, business partners, and customers.

Guide to Cyber Threat Information Sharing


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Audit and Accountability?

[Assistant]
According to Secure Hash Standard (SHS):

1. Set the initial hash value, H (0) , as specified in Sec. 5.3.3.
2. The message is padded and parsed as specified in Section 5.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Awareness and Training?

[Assistant]
According to Guide for Conducting Risk Assessments:

sments at whatever frequency deemed appropriate. Organizations can also attempt to capture changes in the effectiveness of risk response measures in order to maintain the currency of risk assessments.
The objective is to maintain an ongoing situational awareness of the organizational governance structures and activities, mission/business processes, information systems, and environments of operation, and thereby all of the risk factors that may affect the risk being incurred by organizations. Therefore, in applying the risk assessment context or risk frame (i.e., scope, purpose, assumptions, constraints, risk tolerances, priorities, and trade-offs), organizations consider the part risk factors play in the risk response plan executed. For example, it is expected to be quite common for the security posture of information systems (that is, the risk factors measured within those systems) to reflect only a part of the organizational risk response, with response actions at the organization level or mission/business process level providing a significant portion of that response. In


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

[Assistant]
According to Guideline for Using Cryptographic Standards in the Federal Government_ Directives, Mandates and Policies:

s for an other than authorized purposes, have access or potential                              |

|                                   | access to sensitive information, whether physical or electronic.
|
|-----------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Categorization                    | The process of determining the security category for information or an information system. Security categorization methodologies are described in CNSS Instruction 1253 for national security systems and in FIPS Publication 199 for other than national security systems. |
| Ciphertext                        | Data in its encrypted form. |
| Confidentiality                   | The property that sensitive information is not disclosed to unauthorized entities. |
| Critical Infrastructure           | The essential services that support a society and serve as the backbone for the society's economy, security and health. |
| Cryptographic algorithm           | A well-defined computational procedure that takes variable inputs, including a cryptographic key (if applicable), and produces an output. |
| Cryptographic Key                 | A parameter used in conjunction with a cryptographic algorithm that determines its operation in such a way that an entity with knowledge of the key can reproduce or reverse the operation, while an entity without knowledge of the key cannot. |
| Cryptography                      | The science of information hiding and verification. It includes the protocols, algorithms and methodologies to securely and consistently prevent unauthorized access to sensitive information and enable verifiability of the information.

Guideline for Using Cryptographic Standards in the Federal Government_ Directives, Mandates and Policies


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Maintenance?

[Assistant]
According to Recommendation for Block Cipher Modes of Operation_ the CMAC Mode for Authentication:

May 2005 INCLUDES UPDATES AS OF 10-06-2016: PAGE II

The following changes have been incorporated into Special Publication 800-38B. Errata updates include corrections, clarifications, or other minor changes in the publication that are either editorial or substantive in nature.

Recommendation for Block Cipher Modes of Operation_ the CMAC Mode for Authentication


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Incident Response?

[Assistant]
According to Guide to Malware Incident Prevention and Handling for Desktops and Laptops:

## Guide to Malware Incident Prevention and Handling for Desktops and Laptops

## Guide to Malware Incident Prevention and Handling for Desktops and Laptops

Malware, also known as malicious code, refers to a program that is covertly inserted into another program with the intent to destroy data, run destructive or intrusive programs, or otherwise compromise the confidentiality, integrity, or availability of the victim's data, applications, or operating system. Malware is the most common external threat to most hosts, causing widespread damage and disruption and necessitating extensive recovery efforts within most organizations. This publication provides recommendations for improving an organization's malware incident prevention measures. It also gives extensive recommendations for enhancing an organization's existing incident response capability so that it is better prepared to handle malware incidents, particularly widespread ones.

Guide to Malware Incident Prevention and Handling for Desktops and Laptops


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Personnel Security?


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AT.L2-3.2.10 (NIST 3.2.10)?

[Assistant]
According to Digital Identity Guidelines_ Authentication and Authenticator Management:

3.2.10. 3.2.10

4. 3.2.10.

Digital Identity Guidelines_ Authentication and Authenticator Management


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Cell Phone Forensic Tools_ an Overview and Analysis Update provide? (Part 5)

[Assistant]
nvestigation involving cell phones and PDA phones, or construed as legal advice. Its purpose is to inform readers of the various technologies available and areas for consideration when employing them.
Before applying the material in this report, readers are advised to consult with management and legal officials for compliance with laws and regulations (i.e., local, state, federal, and international) that pertain to their situation. · For more information on this effort see www.cftt.nist.gov

## Audience

The primary audience of the Cell Phone Forensic Tool document is law enforcement, incident response team members, and forensic examiners who are responsible for conducting forensic procedures related to cell phone devices and associated removable media. ## Table of Contents

| INTRODUCTION......................................................................................................................... | 1                                                                                |
|----------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------|
| BACKGROUND........................................................................................................................... | 3                                                                                |
| SUBSCRIBER IDENTITY MODULE..................................................................................................

Cell Phone Forensic Tools_ an Overview and Analysis Update


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Communications Protection?

[Assistant]
According to Guidelines for Managing the Security of Mobile Devices in the Enterprise:

| 4.1.2. | Data Isolation Mechanisms....................................................................................16                |                                                                                |
|--------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------|
| 4.1.3. | Platform Management APIs...................................................................................17                  |                                                                                |
| 4.1.4. | VPN Support..........................................................................................................17        |                                                                                |
| 4.1.5. | Authentication Mechanisms...................................................................................17                 |                                                                                |
| Enterprise Mobile Security Technologies...................................................................18 | Enterprise Mobile Security Technologies...................................................................18                   |                                                                                |
| 4.2.1. | Enterprise Mobility Management............................................................................18                   |                                                                                |
| 4.2.2.

Guidelines for Managing the Security of Mobile Devices in the Enterprise


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

[Assistant]
According to A Statistical Test Suite for Random and Pseudorandom Number Generators for Cryptographic Applications:

The need for random and pseudorandom numbers arises in many cryptographic applications.  For example, common cryptosystems employ keys that must be generated in a random fashion.  Many cryptographic protocols also require random or pseudorandom inputs at various points, e.g., for auxiliary quantities used in generating digital signatures, or for generating challenges in authentication protocols.

A Statistical Test Suite for Random and Pseudorandom Number Generators for Cryptographic Applications


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Identification and Authentication?

[Assistant]
According to Security Requirements for Cryptographic Modules:

e/firmware  security;  operating  environment;  physical  security;  non-invasive  security; sensitive security parameter management; self-tests; life-cycle assurance; and mitigation of other attacks.
This standard supersedes FIPS 140-2, Security Requirements for Cryptographic Modules , in its entirety.

Security Requirements for Cryptographic Modules


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AC.L2-3.1.11 (NIST 3.1.11)?

[Assistant]
According to Guidelines for Smart Grid Cybersecurity:

3.1.11 Password Management Vulnerability (CWE-255)

Description

Passwords are the most commonly used form of authentication.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Information Integrity?

[Assistant]
According to BIOS Protection Guidelines for Servers:

| Executive Summary................................................................................................................. 1   | Executive Summary................................................................................................................. 1   | Executive Summary................................................................................................................. 1   |
|----------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------|
| 1. Introduction.................................................................................................................... | 1. Introduction....................................................................................................................


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Internet of Things (IoT) Cybersecurity Colloquium_ A NIST Workshop Proceedings provide? (Part 2)

[Assistant]
and procedures, where they exist, remain operative. For planning  and  transition  purposes,  federal  agencies  may  wish  to  closely  follow  the  development  of  these  new publications by NIST.
Organizations are encouraged to review all draft publications during public comment periods and provide feedback to NIST. Many NIST cybersecurity publications, other than the ones noted above, are available at https://csrc.nist.gov/publications. National Institute of Standards and Technology Attn: Applied Cybersecurity Division, Information Technology Laboratory 100 Bureau Drive (Mail Stop 2000) Gaithersburg, MD 20899-2000 Email: iotsecurity@nist.gov

All comments are subject to release under the Freedom of Information Act (FOIA). ## Reports on Computer Systems Technology

The  Information  Technology  Laboratory  (ITL)  at  the  National  Institute  of  Standards  and Technology  (NIST)  promotes  the  U.S. economy  and  public  welfare  by  providing  technical leadership  for  the  Nation's  measurement  and  standards  infrastructure. ITL  develops  tests,  test methods, reference data, proof of concept implementations, and technical analyses to advance the development  and  productive  use  of  information  technology. ITL's  responsibilities  include  the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems. ## Abstract

This report provides an overview of the topics discussed at the 'Internet of Things (IoT) Cybersecurity Colloquium' hosted on NIST's campus in Gaithersburg, Maryland on October 19, 2017. It summarizes key takeaways from the presentations and discussions. Further, it provides information on potential next steps for the NIST Cybersecurity for IoT Program.

Internet of Things (IoT) Cybersecurity Colloquium_ A NIST Workshop Proceedings

Planning
System and Services Acquisition
Physical Protection
Awareness and Training
Incident Response
Supply Chain Risk Management
Maintenance
System and Communications Protection
Security Assessment
Media Protection
Risk Assessment
Audit and Accountability
Personnel Security
Identification and Authentication
Access Control
System and Information Integrity


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Annual Report 2018_ NIST_ITL Cybersecurity Program provide? (Part 5)

[Assistant]
most noteworthy cybersecurity achievements in 2018 and offers insights into our current priorities and strategies. For a more complete review of our work, check out our primary cybersecurity website.
2

NIST welcomes all suggestions for how we can improve our cybersecurity work to better serve the public and private sectors. And, by all means, please join us as we pick up the pace. Donna F. Dodson NIST Chief Cybersecurity Advisor

<!-- image -->

1/emspace   Federal Information Processing Standard (FIPS) 140-3, https:/ /csrc.nist.gov/publications/detail/fips/140/3/final

2/emspace   NIST Cybersecurity, https:/ /www.nist.gov/topics/cybersecurity

## TABLE OF CONTENTS

| Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . |   . 1 |
|------------------------------------------------------------------------------------------------------------------------------------|-------|
| Imperative 1 - Advancing Cybersecurity and Privacy Standards . . . . . . |     3 |
| Imperative 2 - Enhancing Risk Management . . . . . . . . . . . . . . . . . |     5 |
| Imperative 3 - Strengthening Cryptographic Standards and Validation . |     8 |
| Imperative 4 - Advancing Cybersecurity Research and Applications Development . . . . . . . . . . . . . . . . |    12 |
| Imperative 5 - Improving Cybersecurity Awareness, Training, Education, and Workforce Development . . . . . . . . . . . . . . . . . |    15 |
| Imperative 6 - Enhancing Identity and Access Management . . . . . . . . |    19 |
| Imperative 7 - Bolstering Infrastructure Protection . . . . . . . . . . . . . |    21 |
| Imperative 8 - Securing Emerging Technologies . . . . . . . . . . . . . . . |    24 |
| Imperative 9 - Advancing Security Test and Measurement Tools . . . . . |    29 |

## THIS PAGE IS INTENTIONALLY LEFT BLANK

## INTRODUCTION

It is often said that cybersecurity is about people, process, and technology.

Annual Report 2018_ NIST_ITL Cybersecurity Program